Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

211–220 of 268 posts

Re: HTTPS by default

#211

Post by DaSHacka »

bell-cot wrote: post #187
throawayonthe wrote: post #171

Earlier quoted context omitted.

why not make the point with at least a self signed cert?

99% of visitors wouldn't get the intended point - they'd think he's pro-cert, but forgot to renew it or something.

Honestly I don't even think technical users would get the 'point' most of the time.

Whenever I visit a HTTP-only site, I assume the administrator is either old and does not understand how to set up SSL, or it's an unmaintained/forgotten web server that hasn't been touched in about a decade.

Re: HTTPS by default

#212

Post by popcornricecake »

austin-cheney wrote: post #189

The only challenge to https, as compared to http, is certificates. If not for certificates I could roll out a server with https absolutely anywhere in seconds including localhost and internal intranets. On another note I would much prefer to skip https, as the default, and go straight to WSS (TLS WebSockets). WebSockets are superior to HTTP in absolutely every regard except that HTTP is session-less.

It's not even certificates that's the problem, but trust. And here Google is making exceptions to allow unencrypted connections to private addresses, because trust is hard. If encryption was not tied to trust, then we would have 0 unencrypted connections by now and we would be that much better off.

Making an exception to allow plain HTTP connections instead of making an exception to allow self-signed certificates, seems like the worse choice to me.

Re: HTTPS by default

#213

Post by [deleted] »

1vuio0pswjnm7 wrote: post #210
1vuio0pswjnm7 wrote: post #151

Earlier quoted context omitted.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

Definition of "root server" Authoritative DNS nameserver that serves root.zone, e.g., the one provided by ICANN, or maybe a customised one In own case it is served only to me on local network Many years ago, one of the former ICANN board members mentioned on his personal blog running his own root

[deleted]

Re: HTTPS by default

#214

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #151
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

People using the web can choose what software to use. This includes both client software and server software. Arguably the later ultimately determines whether HTTP is still available on the internet, regardless of whether it is used by any particular client software, e.g., a popular browser

One advertising company through its popular "free browser", a Trojan Horse to collect data for its own purposes, may attempt to "deprecate" an internet protocol by using its influence

But at least in theory such advertising companies are not in charge of such protocols, and whether the public, including people who write server software or client software, can use them or not

Re: HTTPS by default

#215

Post by DaSHacka »

sam_lowry_ wrote: post #176
derf_ wrote: post #136

Earlier quoted context omitted.

>There are dozens of us I guess... Shine on you crazy diamond, and all that, but... > I have been continually confused as to why it is being forced down everyone's throat. Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). Even residential ISPs that one pays for cannot be trusted not to inject content, if given t…

Have you ever opened your work laptop? It is likely MITM'd so that your employer can see everything you read and post on the internet and HTTPS won't help you.

So? I own more devices than a work laptop. I would like to have privacy and security on those.

Re: HTTPS by default

#216

Post by DaSHacka »

ndsipa_pomu wrote: post #192
bigstrat2003 wrote: post #59

Earlier quoted context omitted.

Agreed. I think that the push to make everything HTTPS is completely unnecessary, and in fact counterproductive to security. By throwing scary warnings in front of users when there is no actual security threat, we teach users that the scary warnings don't matter and they just should click past them. Warning when a site doesn't use TLS is a clear cut case of crying wolf.

What would the alternative be? Not warn users when they're about to login to a website that's pretending to be their bank?

Clearly the alternative is to return to HTTP, as these users are suggesting.

Surprised they're still posting, with their employers being shut down at the moment and all.

Re: HTTPS by default

#217

Post by DaSHacka »

sam_lowry_ wrote: post #77
Ferret7446 wrote: post #71

Earlier quoted context omitted.

Devil's advocate, but maybe ISPs should all inject ads to make a point. They make money, and anyone using HTTP gets taught a free lesson on what MITM means

Before turning on the dude who thrives to keep the internet free, fix your corporate laptop that does MITM even for HTTPS connections.

"Free" for fraudsters to get their pickings, maybe.

Re: HTTPS by default

#218

Post by DaSHacka »

bell-cot wrote: post #185
throw_a_grenade wrote: post #175

Earlier quoted context omitted.

The problem is not the site, but the network in the middle. On-path attackers typically don't care about which site they MITM in order to inject javascript e.g. to show ads, insert tracking tokens or hijack the browser for other purposes. The site is the vector, not the target.

Sounds like a great argument for keeping js disabled in my browser. Because "httpS://" does nothing whatever to sanitize the js that it delivers. And one perfectly legit site may pull in js from two dozen or more different servers. Zero of which are magically guaranteed to only deliver benevolent code. Vs. `traceroute` suggests that would-be on-path attackers are up against a vastly smaller attack surface.

> Sounds like a great argument for keeping js disabled in my browser. Because "httpS://" does nothing whatever to sanitize the js that it delivers. And one perfectly legit site may pull in js from two dozen or more different servers. Zero of which are magically guaranteed to only deliver benevolent code.

See:

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Re: HTTPS by default

#219

Post by bell-cot »

DaSHacka wrote: post #211
bell-cot wrote: post #187

Earlier quoted context omitted.

99% of visitors wouldn't get the intended point - they'd think he's pro-cert, but forgot to renew it or something.

Honestly I don't even think technical users would get the 'point' most of the time. Whenever I visit a HTTP-only site, I assume the administrator is either old and does not understand how to set up SSL, or it's an unmaintained/forgotten web server that hasn't been touched in about a decade.

> When ... I assume the ...

If it's (1) obviously recent content*, and (2) something that needs little security - a city council member's blog, or recipes - then how much do you care that it's HTTP-only?

*Or just date-insensitive

Re: HTTPS by default

#220

Post by tepmoc »

I love https, but I also hate that its basically killed on-site caching and give CDNs more power as its only way to distribute content closer to user
Post reply on HN